Accessing web page by SSL VPN web mode

[tedew]

Hello,

I have an issue with accessing web page by  VPN SSL web mode.

When I'm using forticlient (SSL VPN) everything is OK.

Issue is that page is not openning - after I clicked on bookmark is 

My architecture is:

INTERNET client with web browser -> FortiG1(Site1)<- ipsec tunel -> FortiG2(Site2) -> Server 

Facts:

Pages from Site1 are working by SSL VPN webmode

Pages from Site2 don't work by SSL VPN webmod, i tried few servers

But as mentioned abowe , when I use FortiClient(configured to use SSL VPN Tunel mode)  everything is OK, I can open pages from both sites

Could You please advice me where I should start to check ??

Thank You

[abarushka]

Hello,

I would also recommend to collect debug flow traces once the issue is triggered.

[tedew]

hello,

output

id=20085 trace_id=4 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=1, 77.254.x.x:16640->10.0.4.7:2048) tun_id=0.0.0.0 from local. type=8, code=0, id=16640, seq=0."
id=20085 trace_id=4 func=init_ip_session_common line=6024 msg="allocate a new session-0548745c, tun_id=0.0.0.0"
id=20085 trace_id=4 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface ISP-a, tun_id=0.0.0.0"
id=20085 trace_id=4 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel ISP-a"
id=20085 trace_id=4 func=esp_output4 line=844 msg="IPsec encrypt/auth"
id=20085 trace_id=4 func=ipsec_output_finish line=544 msg="send to 77.254.x.x via intf-dmz"

[abarushka]

Hello,

Output looks good. I would recommend to sniff traffic/collect debug flow on the next IPsec peer (site 2).

[tedew]

hello,

I did debug on Site2

id=20085 trace_id=57 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:14388->10.0.4.7:8080) tun_id=10.254.254.1 from Site1-Fiber. flag [S], seq 2436921927, ack 0, win 65535"
id=20085 trace_id=57 func=init_ip_session_common line=6024 msg="allocate a new session-05050af3, tun_id=10.254.254.1"
id=20085 trace_id=57 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-10.0.4.7 via v4-srv-vlan"
id=20085 trace_id=57 func=fw_forward_handler line=719 msg="Denied by forward policy check (policy 0)"
id=20085 trace_id=58 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:14473->10.0.4.7:8080) tun_id=77.254.x.x from Site1-ISP. flag [S], seq 544504241, ack 0, win 65535"
id=20085 trace_id=58 func=init_ip_session_common line=6024 msg="allocate a new session-05051021, tun_id=91.235.252.106"
id=20085 trace_id=58 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
id=20085 trace_id=58 func=ip_session_handle_no_dst line=6110 msg="trace"

[abarushka]

Hello,

Traffic is dropped due 2 reasons "Denied by forward policy check (policy 0)" and "reverse path check fail, drop". I would recommend to check whether there is firewall policy to allow the traffic. Please also find more information about reverse path check by following the link below:

https://community.fortinet.com/t5/FortiGate/Technical-Note-Details-about-FortiOS-RPF-Reverse-Path-Fo...

[tedew]

hello,

Thank You.

Question, to first reason, As I see in snif tool on Site2 the source is 77.254.x.x -and dst is 10.0.4.7.

Policy from 77.254.x.x -> 10.0.x.x is missing or reverse (10.0.x.x to 77.254.x.x) 

Thank You

[tedew]

hello,

I created address object for ISP subnet (of Site1 ) on Site2 FortiGate and I addedd this object as source in policy allowing traffic from Site->Site2.

And there is a progres , page is opening but it takes looong. 

in debgu flow is info that tried by (IPSEC)Fiber link and (IPSEC)ISP link (both are combined as SD WAN ZONE) 

Is any possinility to use only fiber for this SSL WEB traffic ??

id=20085 trace_id=478 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:13229->10.0.4.7:8080) tun_id=10.254.254.1 from Site1-Fiber. flag [S], seq 2373510117, ack 0, win 65535"
id=20085 trace_id=478 func=init_ip_session_common line=6024 msg="allocate a new session-050f5198, tun_id=10.254.254.1"
id=20085 trace_id=478 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-10.0.4.7 via v4-srv-vlan"
id=20085 trace_id=478 func=fw_forward_handler line=881 msg="Allowed by Policy-22:"

id=20085 trace_id=479 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:13229->10.0.4.7:8080) tun_id=10.254.254.1 from Site1-Fiber. flag [.], seq 2373510118, ack 2909354314, win 85"
id=20085 trace_id=479 func=resolve_ip_tuple_fast line=5931 msg="Find an existing session, id-050f5198, original direction"
id=20085 trace_id=479 func=npu_handle_session44 line=1183 msg="Trying to offloading session from Site1-Fiber to v4-srv-vlan, skb.npu_flag=00000400 ses.state=04010204 ses.npu_state=0x06040000"
id=20085 trace_id=479 func=ip_session_install_npu_session line=346 msg="npu session installation succeeded"

id=20085 trace_id=479 func=fw_forward_dirty_handler line=410 msg="state=04010204, state2=00000001, npu_state=06000400"
id=20085 trace_id=480 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:13364->10.0.4.7:8080) tun_id= 77.254.x.x from Site-ISP. flag [S], seq 2991878166, ack 0, win 65535"
id=20085 trace_id=480 func=init_ip_session_common line=6024 msg="allocate a new session-050f51e3, tun_id= 77.254.x.x"
id=20085 trace_id=480 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
id=20085 trace_id=480 func=ip_session_handle_no_dst line=6110 msg="trace"

id=20085 trace_id=481 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:13365->10.0.4.7:8080) tun_id= 77.254.x.x from Site-ISP. flag [S], seq 1044094177, ack 0, win 65535"
id=20085 trace_id=481 func=init_ip_session_common line=6024 msg="allocate a new session-050f51e4, tun_id= 77.254.x.x"
id=20085 trace_id=481 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
id=20085 trace_id=481 func=ip_session_handle_no_dst line=6110 msg="trace"

[abarushka]

Hello,

I notice that the same traffic is coming from different IPsec tunnels Site1-Fiber and Site-ISP. Is it expected behavior?

id=20085 trace_id=478 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:13229->10.0.4.7:8080) tun_id=10.254.254.1 from Site1-Fiber. flag [S], seq 2373510117, ack 0, win 65535"

id=20085 trace_id=480 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=6, 77.254.x.x:13364->10.0.4.7:8080) tun_id= 77.254.x.x from Site-ISP. flag [S], seq 2991878166, ack 0, win 65535"

[tedew]

hello,

hmm, it's hard to say, becouse setup was done few years ago by some partner.

Genrealy routing tables looks like below on both sites:

SITE1 (static to Site2 and default)

S* 0.0.0.0/0 [10/0] via 81.135.x.x, dmz, [1/0]
[10/0] via 156.30.x.x, wan1, [1/0]

S 10.0.0.0/8 [20/0] via SITE2-ISP tunnel 137.27.x.x, [1/0]
[20/0] via SITE2-Fiber tunnel 10.254.254.2, [1/0]

SITE2 (Static to Site1 and default)

S* 0.0.0.0/0 [10/0] via 133.27.x.x, wan1, [1/0]
[10/0] via Site1-Fiber tunnel 10.254.254.1, [21/0]

S 192.168.0.0/16 [1/0] via SITE1-Fiber tunnel 10.254.254.1, [1/0]
[1/0] via SITE1-ISP tunnel 77.255.x.x, [1/0]

and normaly it's working.  Only when SSL VPN web mode(source packets has 77.254 then) is using this behvior occurs. 

Maybe should be added staic route 77.254.x.x/xx when packet has soure 77.255.x.x (when comming from SSL VPN web mode), Becouse  I suspect that packect is arriving  from SITE1 to SITE2 by IPSEC and for back is using default static route on Site2 Firewall, what is Internet link or Ipsec to SITE1(by fiber), what do You think ??

Thanks,

[abarushka]

Hello,

I assume that traffic from site SITE1 to SITE2 is load balanced between different IPsec tunnels (Site1-Fiber and Site-ISP). In case traffic is sent via Site-ISP tunnel, traffic is dropped due to reverse path check fail